@DekOfTheYautja PRECISELY THAT!

Kevin Karhan :verified: (@[email protected])

@[email protected] @[email protected] yes, it it #Signal's [sole fault!](https://infosec.space/@kkarhan/116200603563502633) - Because this attack vector *doesn't exist* in [any halfway decent messenger App / system!](https://infosec.space/@kkarhan/116200603563502633)

Infosec.Space
Kevin Karhan :verified: (@[email protected])

@[email protected] THERE IS *NO LEGITIMATE REASON* FOR #Signal TO DEMAND A #PhoneNumber (= #PII by circumstances if not mandatory doxxing to the governments aka. *"#KYC"*)… - so yes I [do blame Signal](https://infosec.space/@kkarhan/116200585213177913) because this attack vector is unique to #Signal's shittyness and would not exist with @[email protected] / #monoclesChat or even [`cock.li`](https://cock.li) of all places…

Infosec.Space

@kkarhan @GrapheneOS @tails_live @torproject @signalapp

"GrapheneOS chose their requirements and they can happily design their own platform instead."

There's no need to reinvent the wheel. AOSP is a secure, open-source platform that has been around for almost 20 years. I don't want to debate rumors that Google wants to make AOSP proprietary because there is no evidence to support this, especially since it would not benefit them in any way.

"I just think that their stubbornness"

It's not stubborness and I explained why.

"They are the antithesis to #Tails when it comes to #UserFriendly-ness and approachability for #Normies and #TechIlliterates

It's probably the first time I've seen “Tails” and “Normie” in the same sentence, It's not that Tails is difficult to use, but I'm really not sure that many “normies” use it or even know it exists. The user experience on GrapheneOS is almost identical to Pixel OS, the standard operating system for Google Pixel devices, so using GrapheneOS is likely to seem much simpler and familiar to normies, as they will already be used to it.

"Espechally since the problems woth #MobilePhones and the underlying technology ain't fixable with an #AndroidROM

GrapheneOS is not a ROM, Pixel OS is not a ROM, and LineageOS is not a ROM either, theses operating systems are not ROMs.

"Instead we need to foster a #SecurityCulture and proper #ITsec, #InfoSec, #OpSec & #comsec

Indeed, and what GrapheneOS does about security is completely appropriate, including informing people and giving them good advice.

"Otherwise we'll see them fail the same way @signalapp did, which is eitger getting shut down (#EncroChat-style) or being uncovered as a controlled opposition / honeypot (like #ANØM aka. #OperationIronside aka. #OperationTrøjanShield)…"

Signal did not fail, and mentioning Encrochat, ANON, and honeypots in the same sentence is irrelevant. These things have absolutely nothing in common with Signal, you seem to be believing made-up stories.

@Xtreix well, @GrapheneOS chose their requirements and they can happily design their own platform instead.

  • I just think that their stubbornness makes them look like Stallmanist extremists to the point of being unbearable cringe and completely loosing the plot.

To the point that it's cheaper to go black/red and teach that to people, even at the risk of inconvenience.

  • I mean, in many juristictions one will have to do so anyway, but that's not tue point here…

I think #GrapheneOS prefer to "die on their hill" of "moral superiority" than fave the reality that 99% of people can't and won't blow $500 - $1000+ on a phone when any half-decent Netbook with @tails_live , @torproject and #4G or #5G modem can do the same.

Otherwise we'll see them fail the same way @signalapp did, which is eitger getting shut down (#EncroChat-style) or being uncovered as a controlled opposition / honeypot (like #ANØM aka. #OperationIronside aka. #OperationTrøjanShield)…

Red/black concept - Wikipedia

@tranquil_cassowary @halotroop2288 here's a good example:

https://www.criminaldefencelawyers.com.au/blog/possessing-dedicated-encrypted-criminal-communication-devices-laws-and-penalties-in-nsw/

And yes, this can and will be weaponized against any non-#Govware - #backdoored #OS & -Device.

In fact, #Australia banning #SecureDevices and -#Encryption came just after their #HoneyPot "#ANØM" aka. #OperationIronside aka. #OperationTrøjanShield had to end and they had to bust the users as #Estonia was unwilling to extend the permission to host the infrastructure on it's soil on behalf if #FBI & #AFP!

Possessing Dedicated Encrypted Criminal Communication Devices Laws and Penalties in NSW - Criminal Defence Lawyers Australia

The NSW Government has introduced new laws targeting the use and possession of encrypted devices used by criminals to evade law enforcement…

Criminal Defence Lawyers Australia

@Soeren_loeg the fact that @signalapp not only does "#KYC with extra steps" by mandating a #PhoneNumber to this day as well as being solely under #CloudAct whilst basically being a #centralized, #proprietary, #SingleVendor & #SingleProvider solution makes them the ideal candidate for a longterm #HoneyPot like #ANØM aka. #OperationIronside aka. #OperationTrøjanShield.

Not to mention #Signal ticks way too many "#sus" boxes…

Kevin Karhan :verified: (@[email protected])

My [reservations](https://infosec.space/@kkarhan/114234551915193036) and [criticism](https://infosec.space/@kkarhan/114862595629371002) re: #Signal are not just valid, but the reality is *even worse than I thought*: - The fact that @[email protected] requires not only their shitty #Android #App, and a #PhoneNumber but literally won't allow people to use their shitty #Desktop-App unless they have an Android device with a camera pointed at it makes it utterly unuseable for certain users *who don't have a fucking #camera in their Android*… Seriously, do they expect folks to deal with that shit? - It's already worse in terms of #UX than #telegram and #discord and that too makes #XMPP+#OMEMO clients like @[email protected] / #monoclesChat & @[email protected] / #gajim easier and faster to onboard #TechIlliterates onto. - Whichever asshole decided that a *replacement for #SMS* should mandate #PII like a #PhoneNumber & not be natively cross-platform should be banned from doing any #tech in their life. Trying to circumvent this shit and helping folks with it makes me so fucking angry that I'm now explicitly refusing to support it! FIX THAT SHIT, @[email protected], and if it means you need to kick some devs in their crouch then consider this a necessary *"investment"*… #sarcasm #TechSupport #TalesFromTechSupport #Enshittification #SignalSucks #TelegramSucks #Messengers

Infosec.Space

@net_gremlin @andnull +9001%

Add to that #CloudAct and then you know how @signalapp that rubs off #AWS not only can but will snitch on users because if they didn't #Trump (and #Biden befire him) would've unplugged them harder than #EncroChat got.

I'll be shouting #ToldYaSo and expect all those #Signal shills to apologize to me personally when the shit inevitably hits the fan!

https://infosec.space/@kkarhan/115871670255534175

Kevin Karhan :verified: (@[email protected])

@[email protected] no, but they want to be ableto #snitch and #dox users. - Only #cops demand #ID or any *"#KYC" with #PII. - #PhoneNumbers are #PII and are at best merely pseudonymous, but trivially to link to a person. Good systems are #decentralized, #federated, #SelfHosting-capable, #OpenSource & #OpenStandard and offer *real #E2EE* (with #SelfCustody of all the keys!)… - See #XMPP+#OMEMO (i.e. @[email protected] / #monoclesChat & @[email protected] ) and #PGP/MIME (see @[email protected] / #deltaChat and @[email protected] )… Anything else is either a #HoneyPot or run by #UsefulIdiots that consider snitching on their customers as valid strategy. - Cuz we all know neither @[email protected] nor anyone else at @[email protected] is gonna [risk jail for their users](https://web.archive.org/web/20220112020000/https://twitter.com/thegrugq/status/1085614812581715968), and by the amount of users they have, it is a statistical inevitability that they would've had to do so already.

Infosec.Space

@soatok @sarahjamielewis I disagree on @signalapp 's "#Privacy" claims simply because demanding a #PhoneNumber when it's not a "technical necessity" is just indefensibly bad and at best "#KYC with extra steps", thus anti-privacy.

  • If #Signal did put privacy first, they'd refuse to collect any data in the first place and actively make it impossible for them to identify, single-out ot otherwise snitch on users!

To me Signal has the same stench as #ANØM aka. #OperationIronside aka. #OperationTrøjanShield and unless one can 100% #SelfHost and #decentralize it, it's claims are at best #marketing #lies amidst legislation like #CloudAct, that'll give them no choice but to snitch & d0x users to the #US government!

@Mer__edith No.

The fact that @signalapp CHOSE to host the most expensive way possible at a #US military contrator and in spittibgbditance to #CIA & #NSA is so deliberate, it makes #ANØM aka. #OperationIronside aka. #OperationTrojanShield professional by comparison for taking the time and effort to setup shell companies and servers in #Lithuania.

Or to ask bluntly: What Guarantees are there to prevent the #Trump Regime from taking down #Signal once it outlived it's usefulness at skirting #SubshineLaws and #Accountability and #Recordkeeping laws?

  • Even if we assume you and all the coders are willing to "choose death over surrendering the keys" or implementing #Govware #Backdoors (which are wholly unnecessary with you demanding #PII like #PhoneNumbers and #Room641A-Style equipment doing the whole #metadata shit)…

If you don't own and physically control the hardware it's run on, the mere existance of #Signal depends on the goodwill of #JeffBezos!